Edimax BR-6675nD EUVD-2026-31588

Exploitation requires low-privilege authentication to the Edimax BR-6675nD web management interface - the CVSS PR:L metric confirms credentials are a prerequisite. The attack targets the POST request handler at /goform/formHwSet, which is accessible only through the device's HTTP-based administration UI. Vulnerable parameters include regDomain and ABandregDomain (wireless regulatory domain configuration) and nic0Addr, nic1Addr, wlanAddr, and inicAddr (MAC address fields for multiple interfaces). No user interaction is required beyond the authenticated POST submission (UI:N). Exploitation is network-reachable with low complexity and no special targeting conditions (AV:N/AC:L/AT:N). The primary limiting factor is the authentication requirement; however, this is substantially weakened in practice because consumer and SMB-class routers frequently retain default credentials, and the management interface may be internet-exposed. SSVC rates Automatable as no, confirming that the authentication step prevents fully automated mass scanning exploitation.

The CVSS 4.0 score of 2.1 requires careful interpretation and should not be taken at face value for this vulnerability class. The base vector (AV:N/AC:L/AT:N/PR:L/UI:N) reflects network-exploitable, low-complexity, no special conditions, requiring only low-level privileges - a meaningful but often easily satisfied barrier on consumer and SMB routers that ship with default credentials. The impact metrics (VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) rate all impacts as Low with no scope change to subsequent systems, which appears conservative for a command injection on an embedded device where firmware-level code execution typically implies full device control. This scoring discrepancy should be flagged: command injection vulnerabilities on embedded routers routinely yield root-equivalent access, yet the CVSS 4.0 scoring here reflects only partial impact. SSVC corroborates partial technical impact and confirms Automatable: no due to the authentication requirement. EPSS at 1.06% (78th percentile) places this in the upper quarter of all CVEs by exploitation likelihood despite the low absolute probability, which aligns with public POC availability. Defenders should treat actual device-level risk as higher than the raw CVSS score suggests, particularly where default credentials are in use.

An attacker targeting a BR-6675nD with default or weak credentials authenticates to the web management interface and submits a crafted POST request to /goform/formHwSet, injecting shell metacharacters into the regDomain or a MAC address field such as nic0Addr. The device firmware passes the unsanitized value to an OS command, executing the attacker's payload in the device's runtime context. Because a public POC is available, the technical barrier is low for any attacker who has cleared the authentication step.